Vulnerability Management: Compliance Export Enhancements Phase 2

📘
Note
The first set of compliance export enhancements was available on March 19, 2024. See the changelog for more information.

Tenable has made several enhancements to the compliance export API. These enhancements provide additional functionality and ease of use.

New Endpoint—Added a new endpoint that enables users to retrieve a list of the last 1,000 compliance export requests along with their statuses and related metadata. For more information about the end endpoint, see New Endpoint.
New Filters—Added 2 new filters that can be applied to a compliance export when creating a compliance export request with the Export compliance data endpoint. These new filters enable customers to more narrowly define their compliance export results; for example, to export only the compliance results for a certain network or for assets with certain tags applied. For more information about the new filters, see New Filters.
New Response Properties—Added 3 new properties to the compliance export data returned by the Download compliance chunk endpoint, and 8 new properties to the response from the Get compliance export status endpoint. For more information about the new response properties, see New Response Properties.
Other Improvements—Filter names and filter values are now validated for compliance export requests and proper error messages are returned if they fail validation. Additionally, all properties are now returned in responses even when the value is NULL.

New Endpoint

The new endpoint is described in the following table:

Endpoint	Name	Description
GET /compliance/export/status	List compliance export jobs	Returns a list of the last 1,000 compliance export requests along with their statuses and related metadata.

New Filters

The following filters are now available for the Export compliance data endpoint:

Filter	Data Type	Description
`network_id`	String	The ID of the network associated with the scanners that that gathered the compliance data you want to export. The default network ID is `00000000-0000-0000-0000-000000000000`. To determine the ID of a custom network, use the GET /networks endpoint. For more information about network objects, see Manage Networks.
`tags`	Array of Objects	Returns compliance findings for assets that have the specified tags.

New Response Properties

The Download compliance chunk endpoint now includes the following properties in the response:

Property	Data Type	Description
`asset.ipv6_addresses`	Array of Strings	A list of IPv6 addresses that are associated with the asset.
`asset.network_id`	String	The ID of the network associated with the scanners that that gathered the compliance data. The default network ID is `00000000-0000-0000-0000-000000000000`. For more information about network objects, see Manage Networks.
`tags`	Array of Objects	The tags assigned to the asset in Tenable Vulnerability Management.

The Get compliance export status endpoint now includes the following properties in the response:

Property	Data Type	Description
`uuid`	String	The UUID of the compliance export request.
`chunks_available_count`	Integer	The total number of completed chunks available for download.
`empty_chunks_count`	Integer	The total number of empty chunks.
`finished_chunks`	Integer	The number of chunks that have been processed and are available for download.
`filters`	Object	The filters used in the compliance export job request. For a list of possible filters, see the POST /compliance/export endpoint.
`num_findings`	Integer	The number of findings contained in each compliance export chunk.
`asset`	Array of Strings	A comma-separated list of asset UUIDs.
`created`	Integer	The Unix timestamp when the compliance export job was created.

Examples

Example 1: Export compliance data using the new tags filter

For example, to export compliance data for assets with two tags, one tag with the category Office and the value Dallas, and another tag with the category DeviceType and the values Laptop and Virtual Machine, you could use the following cURL request:

curl --request POST \
     --url https://cloud.tenable.com/compliance/export \
     --header 'X-ApiKeys: accessKey=<YOURKEY>;secretKey=<YOURKEY>' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '
{
  "num_findings": 5000,
  "filters": {
    "tags": [
      {
        "category": "Office",
        "values": [
          "Dallas"
        ]
      },
      {
        "category": "DeviceType",
        "values": [
          "Laptop",
          "Virtual Machine"
        ]
      }
    ]
  }
}
'

Example 2: Response from the new endpoint

For example, if you request the list of compliance export jobs from the new List compliance export jobs endpoint:

 curl --request GET \
     --url https://cloud.tenable.com/compliance/export/status \
     --header 'X-ApiKeys: accessKey=<YOURKEY>;secretKey=<YOURKEY>' \
     --header 'accept: application/json'

The response looks like the following:

{
 "exports": [
   {
     "uuid": "3c8d6306-4e94-4203-8b28-57d13469154f",
     "status": "FINISHED",
     "chunks_available_count": 1,
     "empty_chunks_count": 0,
     "finished_chunks": 1,
     "filters": {
       "last_seen": 1717320495
     },
     "num_findings": 100,
     "asset": [],
     "created": 1719912495575
   },
   {
     "uuid": "ce0b0c04-e043-499d-8908-9f9e557d9d24",
     "status": "FINISHED",
     "chunks_available_count": 1,
     "empty_chunks_count": 0,
     "finished_chunks": 1,
     "filters": {
       "last_seen": 1717318694
     },
     "num_findings": 100,
     "asset": [],
     "created": 1719910695474
   }
 ]
}

📘Note

New Endpoint

New Filters

New Response Properties

Examples

Example 1: Export compliance data using the new tags filter

Example 2: Response from the new endpoint

📘
Note